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27 July 1981 
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MEMORANDUM FOR: See Distribution 

FROM : I 

Secur ity Officer, ODP 

SUBJECT : Automatic Data Processing Equipment ~~ 

of Foreign Manufacture - Draft Memorandum 

3 I i— i— a £ 


Attached is a draft of a memora ndum rroffi tne bi rector of 
Data Processing to the Director of Logistics via 1 the Director of 
Security. Please review the draft to ensure that you are in 
agreement with its contents. Please submit your concurrence or 
comments by 3 August 1981. . , 


ILLEGIB 
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DISTRIBUTION: 


- OS/ISSG 
Y OL/ADP & EB 
- OL/SS 

c/o OL/SS 
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ODP-81-955 
24 July 1981 


MEMORANDUM FOR: Director of Logistics 
VIA : Director of Security 


FROM 

SUBJECT 


Bruce T. Johnson 

Director of Data Processing 

Automatic Data Processing Equipment of 
Foreign Manufacture 


1. Automatic data processing equipment (ADPE) manufactured 
in a foreign country is becoming more and more common in the 
American marketplace and, hence, senior ODP managers are becoming 
increasingly concerned, for security reasons, about the possible 
introduction of foreign manufactured ADPE into Central 
Intelligence Agency facilities. Two primary reasons for these 
concerns are physical security considerations and the potential 
requirement for visits to Central Intelligence Agency facilities 


25X1 
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by representatives of foreign manufacturers such as design or 
systems engineers. New equipment will use technology that will 

25X1 


security safeguards. When difficult, complex engineering 
problems are encountered with ADPE manufactured in the U. S., it 
usually is possible and sometimes necessary to bring specialized 
engineering personnel to Headquarters to resolve the problems. 
This clearly would not be possible with a foreign manufacturer 
having a foreign national staff. Our security concerns, 
therefore include: 
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° Embargo of spaces, upgrades, engineering changes, or 
follow-on technology. 
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° Difficulty in access to engineering/manufacturing 
personnel . 

° Possibility of having to utilize foreign national 

engineering/manufacturing specialists for non-routine 
maintenance of hardware/software. □ 

2. I wish to make it clear from the outset that we 
recognize the complexity of this problem. Current Agency 
procurement and security policy does not permit contracting with 
"corporations under foreign ownership, contract or influence. 
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Our intent here is to extend this protection so that it covers 

the location and ownership of the manufacturer even when the 
equipment is obtained from a separate and distinct U. S. -owned 
vendor and the routine maintenance performed by a U. S. -owned 
maintenance organization. We view this situation as a gap in our 
current security and procurement policy and believe for the 
reasons stated above this gap should be closed. Our concern here 
is driven by our knowledge of the current ADPE market where, in 


fact, foreign— manufactured 


are 


available from U. S. -owned sales and service corporations. We 

therefore with the concurrence of the Director of Security and 

your concurrence would like to establish a procurement policy 

which, for security reasons, does not permit the acquisition of 

ADPE substantially of foreign manufacture for use in CIA data 

/ 

processing activities. Until we have more experience with this 
proposed policy our working definition of ADPE substantially of 
foreign manufacture will be that critical subsystems or final 


assembly is performed by a foreign manufacturer. We further 
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define foreign manufacturer in relation to geography c>£ ownership 

(i.e., ADPE manufactured in the U. S. by a f oreign-owned firm 
would also be excluded). | 

3. Representatives of the offices of Logistics, Security, 
General Counsel and Data Processing discussed this matter on 

13 July 1981. They proposed, and I support the proposal, that 
the policy prohibiting the procurement of ADPE substantially of 
foreign manufacturer be established for use in CIA data 
processing activities. If you are in agreement and the Director 
of Security concurs, I suggest that a Headquarters Regulation be 
published establishing this policy. In the interim this policy 

could be implemented in a Procurement Notice. | | 

4. Our view is that the issue of foreign manufacture will 

be evaluated along- with other security factors in the overall 
contractor evaluation process. A panel of Logistics, Security 
and Data Processing personnel can be convened, if required, to 
perform the comprehensive security evaluation. 

5. Requests for Proposal would bring this matter to the 
attention of the potential contractors and contain a 
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questionnaire similar to the DD Form 441S, Certificate pertaining 

to Foreign Interests (attached). A similar form will be 

developed in ODP and coordinated with your office and the offices 

of General Counsel and Security. 

6. As you well know the Agency is increasingly relying on 

automatic data processing equipment for the manipulation and 

storage of classified information. This, in turn, increases our 

vulnerability to security penetrations that exploit weaknesses in 

our ADPE equipment or procedures. We believe this policy is one 

more step in improving our ADP security posture and reducing our 

risk of loss or compromise of classified information. 
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Bruce T. Johnson 

Attachment: a/s 

CONCUR: 
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Director of Security 
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